8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-3304

CVE-2026-3304: Multer vulnerable to Denial of Service via incomplete cleanup

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-3304

CVE-2026-3304:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
multer	npm	< 2.1.0	2.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-3304, is a Denial of Service in multer versions prior to 2.1.0. It's caused by the incomplete cleanup of temporary files when processing malformed multipart/form-data requests. The analysis of the patch commit 739919097dde3921ec31b930e4b9025036fa74ee reveals that the core logic flaw resides in lib/make-middleware.js. Specifically, the makeMiddleware function, which constructs the file-handling middleware, failed to correctly handle cleanup in error scenarios. When a malformed request caused an error, the system would create temporary 'placeholder' files for subsequent parts of the request but would not remove them. The patch rectifies this by adding a check for an errorOccured state within the fileFilter callback. If an error has already been detected, the code now explicitly removes the placeholder file and stops further processing. This prevents the accumulation of orphaned files on the server's storage, thus mitigating the DoS vector. Therefore, the makeMiddleware function is the primary vulnerable function, as it contains the logic that was exploited.

Vulnerable functions

makeMiddleware

lib/make-middleware.js

The `makeMiddleware` function is responsible for processing multipart file uploads. A vulnerability existed where, if an error occurred while parsing a part of the multipart request, subsequent file parts would still have placeholder files created for them but would not be properly cleaned up. This is because the `fileFilter` callback did not check if an error had already occurred. An attacker could send a malformed request that would cause an initial error, and then send many subsequent file parts, each of which would create an orphaned file on the disk, leading to resource exhaustion and a Denial of Service. The patch adds a check for the `errorOccured` flag at the beginning of the `fileFilter` callback to ensure that if an error has already been flagged, the placeholder file is removed and processing of the stream is halted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.